The "global police force" metaphor is used a lot but it is completely wrong.

The actions on the international stage are driven entirely by economical and geopolitical interests. If it so happens that the operation appears to "do good" then a media spin will be applied, furthering the "global policeman" illusion.

On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terr

On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terrorists to keep on destabilizing a country, etc., etc., these are not mentioned in the policing context.

This would be logical. The weird thing is they are. I have seen for example Vietnam, Cuba and Chile used in exactly the context you describe, including here on slashdot. It appears that most people in the US don't actually understand the details of what happened in those cases so people get away with such absurd and outrageous nonsense without being called on it.

I guess you can maintain a spurious moral high ground, and allow the US to fight your battles for you, all the while decrying their supposed Colonialism. Go look at the UN funding and see where lion's share of the money, infrastructure and personnel come from.

It wasn't RSA. They trusted the NSA, with good reason. The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later.

Then someone figured out that the way this new RNG is set up, the constants the NSA chose *could be* the public half of an asymmetric key, and if so the RNG's state could be read with very little effort by anyone in possession of the private half. There is no mathematical way at all to tell whether this is the case, but apparently something in the Snowden documents at least strongly suggests the NSA did know about it and did use it.

It's important to highlight that this isn't the kind of weakness anyone _else_ can take advantage of; a blackhat would still have to discover their private key, the exact same problem he was facing before. The NSA are apparently not dumb enough to rely on keeping math a secret.

But it seems every successful security service forgets the basic lesson: set up a system with unchecked power, the scum of the earth will eventually take notice. From that moment they'll dedicate their lives to getting control of it. They'll eventually succeed.. Snowden took advantage of criminally slack security in the NSA. Just the the fact that he could reveal the documents he revealed is proof the NSA have already gotten arrogant and sloppy, never mind what's in them.

Of course it is easy to foreign agents to get ahold of any secret. The more info collected into one place, the bigger the carrot.They're trained to wrestle information out of government and corporate hands. What will it take? Money? Threats? Violence? Brainwashing?

It's likely that the issues with DES would have been discovered sooner had they not been fixed, after all an actively used system is far more worthy of study than something thats been superseded and is no longer used.

As for discovering the private key, who's to say Snowden doesn't have a copy of it? And for all we know, that key could have been leaked to others long ago, the US is not the only country that conducts spying...

It's likely that the issues with DES would have been discovered sooner had they not been fixed, after all an actively used system is far more worthy of study than something thats been superseded and is no longer used.

That is nonsense. The fixed DES was identical to the original DES, with the expectation of a couple of seemingly arbitrary numbers. Nobody's going to stop researching DES because the NSA changed a couple of numbers. In fact, the opposite is far more likely.

"The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later. "

Are you being sarcastic? The "improvements" they made are now being looked at, 15 years later, as examples of Government backdoors in their encryption.

(I know it's not every case, but the consensus is that it was in THIS case, and possibly several others. I have friends in the field and they knew about this particular instance of PRNG for elliptiical curve crypto way back when. Few trusted it except, apparently, RSA and its customers.)

Sadly just a month ago such a comment would be modded -1 offtopic or -1 flamebait as the equailivant of that crazy guy drunk talking to himself on the subway.

Slightly different topic, this algorithm seems very strong as it is what slashdotters say is a perfect encryption mathmatical algorithm. It is Elispse based so there are more numbers to guess and the seed process is very stenious to make it harder to crack. It seems like the best one which is why BASE libraries use it just on that evidence. Can a mathmatician or crypto expert explain why this NSA endorsed algorithm has so many problems compared to SHA-2 or BES?

The problem is that the magic numbers used in the algorithm have no known source so no one in the community can go back and find the justification for them. They are just there. I see the potential vulnerability here is that if you know the base numbers here, and since it is elliptical, that it simplifies the brute-force decryption process. How much? We don't know, yet. The problem is being looked at as I type.

From the 1920's on the ~GCHQ and ~NSA gave UK and US political and military leaders limited and then full plain text about the world.
With the generational (1950-80's) change from dedicated cryptography machines to the 'internet' that same political and military deal had to be met.
How do you get the world chatter? You have to create any emerging digital standards. Just as the cryptography machines and telco equipment where interfered with and sold cheap to friendly nations.
If the UK and US encounter pe

French, Germans, Japanese, and Italians wanted US political aid, trade, mil support, they did what they where 'told' and kept to a US/UK set standard.
If any national crypto private or public sector standards emerged from with in Asia or the forming NATO/EU the UK and US where quick to request individual firms or nations come back to the set 'NSA/GCHQ' weakened standard.
How would any nations mil or political leader say 'no' to the full might of NATO or the USA crypto?
Saying yes to the NSA/GCHQ bought in a

I've never seen any examples of negative press from government sources.

More likely the US simply developed an entire line of dedicated processors that can crack almost any code.This probably happened about the same time they dropped their designation of encryption as a munition.They already had the solution in hand.

However, when real time continuous encryption started to be the norm, (like encrypted Skype, VPNs in routers, and SSL everywhere)they simply bought their way into the companies doing it, and induced them with money and contracts.

I've stated more than once here that I believe it will be eventually revealed that the NSA fully funded Microsoft's acquisition of SKYPE.Probably because EBay was incompetent and not terribly interested in ripping out the un-traceable routing via smallremotely distributed groups of nodes and many volunteer notes.Even if Ebay did provide access to the encryption technology, they couldn't circumvent the routing issues to provide taps.

The first thing Microsoft did was route all traffic through their servers. No more routing via anonymous "volunteers" or off-shorepeer-to-peer technology. It now goes direct to Microsoft and then to the other party. There was never a business case to do this.It was working just fine, and hasn't improved since Microsoft took over. There was ONLY ever an intelligence case to make this change.Why would Microsoft take on that expense for free? Because the NSA bought Skype for them.

The first thing Microsoft did was route all traffic through their servers. No more routing via anonymous "volunteers" or off-shore peer-to-peer technology.

That's not true. Earlier this month I have seen my Skype calls get routed through peers, who were not participating in the call. That however resulted in very unreliable calls, so I got the machine running Skype onto a public IP address. With that in place I could see the traffic was going directly between me and the IP addresses of the people I was commu

I've also seen Skype work when it shouldn't - behind corporate firewalls that are supposed to be blocking traffic.

When parties on both sides of a firewall are cooperating in getting data through the firewall, there is little you can do to stop them. The solution is to limit what software gets to run on the trusted side of the firewall. If you don't want Skype on your network, then don't install it. Some corporations do use Skype as part of their work. Those corporations are happy that Skype is so easy to ge

for one, SHA-2 is a hashing algorithm, not encryption. Secondly, although the math is sound, the algorithm which generates the seed for the PRNG is allegedly based on constants which make the crypto trivial for the NSA to brute force.That algorithm is known as Dual_EC_BRDG.

Up to a month ago such a comment would've been modded to -1 because historically, NSA had helped improve [schneier.com] the security of encryption standards. As Schneier has said, the revelations about recent NSA activity has completely evaporated the goodwill NSA earned in the cryptographic community from back then.

Up to a month ago such a comment would've been modded to -1 because historically, NSA had helped improve [schneier.com] the security of encryption standards.

Schneier has been speculating [schneier.com] about the possibility of an NSA planted backdoor in Dual_EC_DRBG since 2007. Which by the way took me a few attempts to find again since there are many hits if you search for NSA backdoor on his site.

As Schneier has said, the revelations about recent NSA activity has completely evaporated the goodwill NSA earned in the cryptographic comm

The problem is that RSA made the worst generator (in every respect) of several the default. That cannot have been an engineering decision or a business decision in the interest of their customers. It is dead certain that NSA coercion is behind it, anybody that can build a working crypto library cannot be that incompetent.

There's no point in pussy-footing around this. It's obvious that RSA was either forced or "rewarded" into using an insecure method. And that they knew it at the time (because they are cryptographers and because they don't live in the bottom of a well.)

The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with? And, most importantly, how can we verify that replacement?

1) RSA intentionally weakens their crypto at the behest of the NSA (this is fairly certain)2) Chinese hack RSA - the only question is just how thoroughly (a known fact)

Now comes the speculation.

3) China analyzes what they got from RSA and discover the crypto is weaker than expected.4) Quietly, China also begins to take advantage of this breakable crypto the NSA foisted on US companies and citizens.5) China deduces why it was done and starts looking for weaknesses in other US crypto products - possibly succeeding, given they have a decent idea what to look for.

Followed by

6) China successfully and quietly penetrates most US defense contractors and financial institutions.

I think we're on the same channel here. But the exact mix of brilliance and stupidity is really not so important. Whatever the magnitude of the individual parts, the end result is still that NSA can't be trusted to act in the public good.

It certainly explains how they've managed to penetrate so many large corporations, and in such a short window. There was a common weak security element between all these companies, and this was likely it.

I do remember the RSA was hacked into not so long ago, and a good chunk of their data was stolen. I wonder if they got a dose of their own medicine. In fact, I wonder if they allowed it to happen deliberately, to show the spooks what happens when they try to sabotage everybody indiscriminately.

The dongle hack was information about the SecurID token, which does not use the same PRNG. Of course this information is probably from RSA itself since it is sourced anonymously. The SecurID hack was apparently a phishing e-mail exploiting CVE-2011-0609 according to f-secure, so not specifically an RSA failure.

In other words, not the same crypto in question. Your scenario is probably more like 2 steps:

"The dongles weren't hacked. Someone broke into RSA and stole the seed records, which is what goes inside the security dongle (and is supposedly impossible to extract from the dongle)."

Technically correct. I almost wrote "but it's a distinction with no difference"... except that's wrong. It's actually WORSE. It means it wasn't just a bug... RSA was woefully irresponsible with vital user data.

There is no reason for them to provide dongles pre-seeded... And if you buy such devices, you have no proof that the records have been destroyed even if the company claims they have.Customers should be able to seed their own dongles.

Ofcourse i've been saying this for years, asking what happens if rsa get hacked and all the seeds taken... People said that was crazy talk, rsa would never get hacked etc.

The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with?

I have no need to, because I don't use any of RSA's software toolkits.

I use Microsoft CryptoAPI, GPG, GnuTLS, and OpenSSL, php-Mcrypt/php-Mhash, and some dedicated non-RSA special purpose libraries, for all my cryptography requirements.

Here's the problem. Dual_EC_DRGB is flawed, but is *required* to be implemented as part of anything that claims FIPS 140-2 compliance. Anything cryptographic you sell to the government is *required* to be FIPS 140-2 compliant, and operated in FIPS 140-2 compliant mode.

This includes just about all routers, switches, firewalls, operating systems and any other network or security gear in use by the U.S. gov't. Companies that supply this equipment include Cisco, HP, Dell, IBM, Juni

I checked it in a couple of different browsers. Only the Android browser made it look correct, and that was only on the second viewing using that browser.When I first viewed it, it was broken in Android too. Most lines are repeated three times. For example, the sentence starting with "Here's the problem. Dual_EC_DRGB is flawed" is in there three times. I wonder what you'll see if I repost a copy / paste of the text:

Yeah. Good luck with making that a standard. No one wants a standard that has to be re-standardized everytime its used. The obvious answer is using cryptographic methods that are not part of anything to do with RSA. And let the standard play ketchup. I don't give a fuck if its not compliant, I want it to be secure.

One of the major reason public key crypto was invented is the difficulty associated with securely distributing symmetric crypto keys.

A one-time pad is essentially a massive symmetric crypto key, so you're back to square one. And good luck distributing a copy of your one-time pad to everywhere you do e-commerce with, like your bank, Amazon.com and the like.

Fixed. The problem with security is that you can't actually sell it; the customer has no way to tell if they are really secure, or just feeling secure. But the customer can certainly tell if they feel secure. So all security vendors tend to major on the warm fuzzy feelings. That means a lot of "trust us, we're the experts" and "you don't need to know the details, put your mind at ease" and not a lot of "here is the exact proof that you are secure, including every line of our source code and every mask in ou

I see some RSA shills repeating this argument... but I don't see any explanation why they used it as the default after 2006. We really have no greater proof it's backdoor'd now than we had then... if we didn't have the 2006 analysis of Dual_EC_DRNG then Snowden's leak could be referring to a whole lot of things.

All that has happened is that the legal threshold of plausible deniability has disappeared... but the common sense threshold for plausible deniability disappeared in 2006, they knew and they kept

There are two separate points here - one, that RSA did not change the default, and two, that it was at the direction of the NSA. My objection is to the second. Maybe I am misreading, but you are taking the given, that the default was not changed, to mean that it therefore must have been at the request of some government agency. It is a simple and compelling argument to make, but it doesn't stand up given what I understand.

"RSA shills" are simply pointing out what RSA claimed. I have not seen anything so

Actually this is not true, and it is obvious you have never done any crypto work yourself, having taken graduate level courses on the topic, I can tell you that 1) it is hard to prove that an encryption system (b/c thats what PRNG is at the core) is 'slightly' insecure, Proving glaring obvious faults is easy. 2) not every crypto secret is publicly known, look at DES and EC attacks

Take AES for example, its the standard that pretty much everything uses for symmetric enrcryption, but it is NOT a feistel ciphe

The AES s:boxes already have an algebraic solution in themselves, as do every step of the process, rotates, xors, sums mod 2^32 etc. The problem is the combinatorial explosion that happens even over the course of one round when you combine all the operations, meaning there's so many simultaneous equations to solve, you'd need huge amounts of plaintext and corresponding cyphertext to even establish a few bits of the key.

No, I still blame them. They should have shut down their shop and moved overseas to a better location. Instead, they chose to defraud all their customers by selling snake oil for millions of dollars. The RSA company is a bunch of immoral fraudsters and they all deserve to be thrown in jail.

Don't forget that this default also selected the slowest generator and the one with the worst security analysis. There is no way this was an engineering decision. In fact I would not be surprised if some people working on the library resigned right at the time this decision was made...

There's the proverb about not attributing to maliciousness that which can be explained by stupidity.

VMware (also an EMC subsidiary) used an RSA implementation for their SSO product. It had a ton of problems and bugs, and each new patch release introduced more bugs. Applying pressure to RSA via EMC didn't help, so VMware ripped out the RSA implementation with a band new in-house implementation.

"stupid" is not in the picture. Making the slowest generator, and the one with doubtful security at the same time, the default is not stupid, it has to be deliberate. Now if the NSA people were any good at their business, they would have made sure that their compromised generator was the fastest, so as to give a plausible reason for making it the default. They failed event at this simple Deception-101 idea.

The more I hear, the more I think the NSA is a ham-handed, incompetent, slow and stupid bureaucracy th

Recall the NSA funding and internal standing in the US gov structure in the 1990's?
They had to deliver plain text 24/7 or face even less funding or other groups would have offered language contractors and bulk clearances.
The only trick was keeping the citation needed over generation.

When it was discovered in 2007 that the NSA insisted on adding this PRNG to the standard, with constants they chose the general reaction was "so what? after all, this is one of many alternatives, and it is the slowest and least efficient". I assumed their idea was to somehow choose the PRNG in applications where they were one of the parties, but that seemed unlikely.

It's now clear what the idea was: secretly having companies use this PRNG. The original assumption was that companies voluntarily choose what

In the article linked to on ArsTechnica a cryptographer wishes to remain anonymous, though his comment is perfectly reasonable and very safe:

"I personally believed that it was some theoretical cryptographer's pet project," one cryptographer who asked not to be named told Ars.

He (or she) is not accusing anyone or suggesting anything. Why the desire to remain anonymous? I bet that many people active in cryptography even in academic circles are afraid. Indeed, chances are that active researchers are being

Why would the NSA deliberately weaken crypto algorithms ?Sure, that makes spying easier but it is also quite dangerous. Because if the vulnerability is found anyone can access the encrypted data, including the enemies.

Think about it : the NSA releases a "recommended" crypto package. Obviously, US companies will be much more likely to use it than, say, the Chinese. If this package happens to be weak and that the Chinese find out, US companies will be the most affected. Also, to spy on its own citizen, it is